EP1770940B1 - Verfahren und Vorrichtung zum Aufbau einer Verbindung zwischen einer mobilen Vorrichtung und einem Netzwerk - Google Patents

Verfahren und Vorrichtung zum Aufbau einer Verbindung zwischen einer mobilen Vorrichtung und einem Netzwerk Download PDF

Info

Publication number
EP1770940B1
EP1770940B1 EP05109127A EP05109127A EP1770940B1 EP 1770940 B1 EP1770940 B1 EP 1770940B1 EP 05109127 A EP05109127 A EP 05109127A EP 05109127 A EP05109127 A EP 05109127A EP 1770940 B1 EP1770940 B1 EP 1770940B1
Authority
EP
European Patent Office
Prior art keywords
mobile device
access
network
server
authentication
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP05109127A
Other languages
English (en)
French (fr)
Other versions
EP1770940A1 (de
Inventor
Efstathios Ioannidis
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Athonet SRL
Original Assignee
Alcyone Holding SA
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alcyone Holding SA filed Critical Alcyone Holding SA
Priority to EP05109127A priority Critical patent/EP1770940B1/de
Priority to AT05109127T priority patent/ATE484143T1/de
Priority to DE602005024000T priority patent/DE602005024000D1/de
Publication of EP1770940A1 publication Critical patent/EP1770940A1/de
Application granted granted Critical
Publication of EP1770940B1 publication Critical patent/EP1770940B1/de
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/168—Implementing security features at a particular protocol layer above the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H04W8/12—Mobility data transfer between location registers or mobility servers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/20—Transfer of user or subscriber data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/04—Network layer protocols, e.g. mobile IP [Internet Protocol]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices
    • H04W88/06—Terminal devices adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W92/00—Interfaces specially adapted for wireless communication networks
    • H04W92/02—Inter-networking arrangements

Definitions

  • the present invention relates to establishing communication between a mobile device and a network through an access network.
  • Mobile Cellular networks have now become widespread through the world. For the most part these mobile networks are constructed using one or more of the following cellular technologies: GSM, UMTS, EDGE and CDMA. These are all considered Wide Area Network (WAN) technologies since their radio coverage is "wide", meaning that they span entire areas, cities, regions or countries.
  • WAN Wide Area Network
  • WLAN Wireless Local Area Network
  • IEEE Institute of Electrical and Electronic Engineers' 802.11 wireless standard
  • Both Mobile Cellular and WLAN networks can be used to transport Internet Protocol (IP) traffic and are important in the wireless market.
  • IP Internet Protocol
  • Mobile Cellular technologies and WLAN technologies have been developed separately and thus networks made with these technologies cannot be easily integrated nor managed efficiently. This makes it difficult for a mobile operator to make good use of these different types of technologies in a single network that is easy to manage, build and expand.
  • WLAN UE User Equipment
  • Wired UE uses the IEEE 802.1x (abbreviated to 802.1x) protocol and the Extensible Authentication Protocol (EAP) methods in order to prove that it is allowed to gain access to the WLAN network.
  • EAP Extensible Authentication Protocol
  • the authentication information used to gain access to the network is based on the well-known cellular authentication methods based on the Subscriber Information Module (SIM) card.
  • SIM Subscriber Information Module
  • the WLAN UE 100 uses EAP-SIM or EAP-AKA authentication protocol transported by the IEEE 802.1x to exchange authentication information with the IEEE 802.1x capable Access Point (AP) 101.
  • the 802.1x AP 101 includes AAA (Authentication, Authorisation and Accounting) client functionality, which typically means it acts as a RADIUS client.
  • AAA Authentication, Authorisation and Accounting
  • the AP 101 then forwards the EAP authentication information to the local visited AAA server 103. Typically this means that the AP 101 functions as a AAA client towards the visited AAA server 103.
  • the visited AAA server 103 uses the EAP authentication information to determine the WLAN UE's Home AAA server.
  • the visited AAA server 103 then passes the authentication information to the home AAA server 110.
  • the EAP/AAA server and HLR proxy 107 processes the authentication information and checks it against the authentication triplets or quintuplets obtained from the HLR 109. Based on these checks the EAP/AAA server 107 replies to AP 101 with an accept or reject message. As a consequence the AP 101 forwards the appropriate 802.1x EAP success or reject message to the WLAN UE 100. If the message indicated successful authentication then the 802.1x AP 101 allows the WLAN UE 100 to use the WLAN network to communicate towards other peers, Internet or external networks 108. Otherwise in case the authentication was rejected the 802.1x AP 101 will not allow the WLAN UE 100 to make use of the WLAN access network.
  • all WLAN Access Points (APs) in all WLAN Access Networks must support the 802.1x standard that allows transport of the EAP-SIM and EAP-AKA authentication methods over IEEE 802 networks (including Ethernet and WLAN) between UE and ultimately the home AAA server.
  • IEEE 802 networks including Ethernet and WLAN
  • the majority of WLAN APs deployed today in WLAN networks do not support the 802.1x standard, such as simple AP 102 in 0.
  • support of EAP-SIM and EAP-AKA on 802.1x in WLAN UEs may be slow to be adopted and may run into difficulties.
  • WLAN Access Server 105 typically used to provide access control by authenticating users and allowing packet communications destined to or originated from authenticated users.
  • AS WLAN Access Server
  • the WLAN AS 105 intercepts the web page request (typically the browser's "home page" at start-up) being accessed and redirects it to an authentication web page where the user is to enter authentication credentials such as username and password or valid credit card information. If these credentials are entered correctly then the WLAN AS opens up access for that WLAN UE by opening the communication ports for packets coming from and destined to the WLAN UE's IP address and MAC address.
  • WLAN ASs no longer have a role since the authentication functionality is distributed to the APs.
  • the idea of discarding an existing investment such as the WLAN AS 105 may not make sense to all WLAN Access Network providers, since the actual centralised access control functions can in principle be reused. Also if a WLAN Access Network contains both 802.1x capable APs and simple APs the interoperability between the WLAN AS and the 802.1x authentication methods poses problems.
  • WLAN AS 105 redirecting the user to another web page at start-up. This approach is not always applicable, since some WLAN UEs do no have web browsers. In addition it can be confusing for a user to have to open up the web browser and perform an authentication before starting the application that was required in the first place (e.g. email application).
  • the present invention seeks to provide a method of, a system for and a gateway for establishing communication between a mobile device and a network through an access network according to the appended claims 1 to 44.
  • the invention also provides an Access Controller (AC) comprising a Point-to-Point over Ethernet (PPPoE) server for tunnelling AKA dialogues from a PPP-client installed in the terminal for the same purpose, and also comprising a traffic Router and a RADIUS-cient.
  • the AC thus including the RADIUS-client is interposed between a RADIUS-proxy accessed from the access point (AP) in the WLAN and the mobile network where SIM-based authentication is carried out.
  • FIG. 2 an embodiment of an improved wireless local area network (WLAN) Cellular network architecture in accordance with the present invention is shown.
  • WLAN wireless local area network
  • a Cellular Gateway (CellGate) Server 200 (authenticating gateway) is placed in a WLAN Access Network 106 (access network).
  • a WLAN user equipment (UE) 100 mobile device
  • the Home Cellular operator typically manages a Wireless Gateway 203, a Home Location Register (HLR) 109 and a Home Mobile Services 206 that are situated in the Home network.
  • the Home Cellular operator also distributes CellGate software client 204 that runs on the WLAN UE 100 to a plurality of WLAN UEs. This invention is not limited to such a specific location or management of these network nodes, but this scenario is used as a means to most clearly describe the invention.
  • the CellGate client 204 accesses the Subscriber Identity Module (SIM) or Universal Subscriber Identity Module (USIM) on the WLAN UE and communicates with the CellGate Server 200 to authenticate the WLAN UE.
  • SIM Subscriber Identity Module
  • USIM Universal Subscriber Identity Module
  • the communication between CellGate client 204 and server 200 is based on EAP.
  • the CellGate Server 200 then functions as an Authentication, Authorization and Accounting (AAA) client towards the local Visited AAA server 103.
  • AAA Authentication, Authorization and Accounting
  • the local Visited AAA server 103 identifies the WLAN UE's Home network by inspecting the authentication information and it passes the AAA message towards the appropriate Home AAA Server 110.
  • the EAP/AAA Server 201 is configured with the address of the Home AAA server and therefore processes AAA traffic directed to the Home AAA server.
  • the Home AAA server examines the authentication information and determines whether it is a Cellular WLAN SIM-based authentication (e.g. EAP-SIM or EAP-AKA). If it is a SIM-based procedure the EAP/AAA Server 201 will process the request to verify the device credentials, which may or may not be directly related to the user of such device. A Challenge/Response security procedure is performed as will be described in more detail later.
  • the EAP/AAA Server 201 will determine whether the correct credentials have been supplied by sending a request to the HLR Proxy 205 to obtain the appropriate user's security quintuplets or triplets.
  • the HLR Proxy 205 processes this request, obtains the set of security quintuplets or triplets by requesting them from the HLR 109 and returns them to the EAP/AAA Server 201.
  • the EAP/AAA Server 201 then checks the requesting security quintuplets or triplets against the information supplied by the WLAN UE. If the security information supplied by the WLAN UE matches with that returned by the HLR then the WLAN UE has been successfully authenticated, otherwise the authentication has failed. If the authentication is successful then the WLAN UE is able to utilise the WLAN Access Network to send and receive data traffic as will be described in more detail later.
  • the authentication result is sent from the Home AAA Server 110 to the Visited AAA Server 103 and finally to the CellGate Server 200.
  • the CellGate Server 200 will then inform the WLAN UE of the result.
  • the CellGate Server 200 also communicates with a WLAN Access Server (AS) 105 in order to unblock communication for the WLAN UE. This is done by sending the WLAN UE's IP address and layer 2 (MAC) address from the CellGate Server to the WLAN AS, so that the WLAN AS allows traffic to and from this WLAN UE to pass through it.
  • the CellGate Server 200 also sends the WLAN UE profile to the WLAN AS 105 so that the WLAN AS may perform special handling of the WLAN UE's traffic as will be described in more detail later.
  • MAC layer 2
  • the WLAN UE CellGate software client 204 requests access from the CellGate Server 200 in message 1. This prompts a message from the CellGate server for the WLAN UE's identity in message 2.
  • the identity can be the WLAN UE's Network Address Identifier (NAI) or any other identifier that can be used to uniquely identify the WLAN UE and the realm that it belongs to.
  • Message 2 also contains information on the WLAN Access Network Provider, such as the operator's name and the capabilities or services available.
  • the WLAN UE CellGate client 204 replies with its identity in message 3.
  • An Access request (including the WLAN UE's identity) is then sent from the CellGate server 200 to the local Visited AAA 103 server in message 4.
  • the Visited AAA server 103 in turn forwards the Access Request to the home AAA server 110 in message 5.
  • the home AAA server 110 authenticates the WLAN UE CellGate client 204 by sending a cryptographic challenge that requires a particular cryptographic response based on the WLAN UE's shared secret and a sequence number.
  • the challenge is sent in message 6 to the WLAN UE's local visited AAA server 103.
  • This challenge is sent in Message 7 from the local visited AAA server 103 to the CellGate server 200.
  • the CellGate server 200 forwards the challenge to the WLAN UE Cellgate client 204 in message 8.
  • the WLAN UE CellGate client 204 verifies whether the challenge is correct based on its knowledge of the shared secret and the sequence number. This allows the WLAN UE to authenticate the home AAA server 110 (i.e. determine whether the Home AAA server that issued the challenge is really the WLAN UE's Home server rather than a malicious entity).
  • the WLAN UE Cellgate client 204 replies with message 9, based on the result of its authentication procedure, which includes the response to the challenge if the Home AAA server 110 was authenticated correctly in the previous step.
  • the WLAN UE CellGate client's response in message 9 is sent to the CellGate server 200 that forwards it to the local Visited AAA server 103 in message 10.
  • the local Visited AAA server 103 forwards the Response to the Home AAA server 110 in message 11.
  • the Home AAA server 110 checks the Response to the challenge against the expected response and thus determines whether the WLAN UE has performed successful authentication or not. Upon successful authentication the Home AAA server 110 authorises the WLAN UE 100 for network access by informing the local Visited AAA server 103 of the successful result of the authentication. This information is included in the Access Reply message 12. In the same message the Home AAA server 110 includes the WLAN UE's profile and some of the keys required for the UE to secure communication with local nodes which is described in more detail later.
  • the authentication result information in the Access Reply message is forwarded from the local Visited AAA server 103 to the CellGate server 200 in message 13.
  • the CellGate server then extracts the WLAN UE's profile and keys required to communicate with the WLAN UE in a secure manner and informs the WLAN UE of the authentication result in message 14.
  • Message 14 does not include any keys or the WLAN UE's profile since that information is kept by the CellGate server 200.
  • the CellGate server 200 sends a Command message (Message 15) to the WLAN AS 105.
  • This message commands the WLAN AS 105 to allow the WLAN UE's traffic through it and instructs the WLAN AS 105 how to handle that traffic by providing it with the WLAN UE's profile related to data traffic. If the profile requires secure connection between the WLAN UE 100 and the WLAN AS 105 then the CellGate server also includes security information in Message 15, including the security keys and security type which is described in more detail later.
  • Mutual authentication between the WLAN UE and the Home AAA server is utilised in this embodiment of the present invention, such that the WLAN UE can determine that the Home AAA Server is not a malicious impersonating node and vice versa for the Home AAA Server with the WLAN UE.
  • a successful authentication allows the device to gain access to the visited WLAN Access Network.
  • a hierarchy of keys is generated. This is known to the end device (WLAN UE) and the Home AAA server.
  • Some of the keys can be used to secure communication between the WLAN UE and various application servers in the visited or home network.
  • a subscriber's profile is downloaded from the Home AAA server to the Cellgate server in the visited WLAN Access network, through the local Visited AAA server.
  • a temporary identifier for the WLAN UE is generated by the Home AAA server to be used by network nodes in the Visited network when communicating with the WLAN UE, or when communicating information about such WLAN UE to other network nodes.
  • the temporary identifier is sent from the Home AAA server to both the Cellgate server and to the WLAN UE. Communication with the Cellgate server is done through the local Visited AAA server.
  • the temporary identifier is encrypted when sent to those entities.
  • the temporary identifier and its encryption is needed to allow for user anonymity.
  • the Home AAA server is configured with different spaces of numbers as follows:
  • the Permanent identifier space can be further divided to indicate different categories of users. Such division need not be universal and can be done by the operator.
  • Every Home AAA server stores all Permanent identifiers and the shared secret (root key) associated with each identifier.
  • the root key is known only to the Home AAA server 110 and the WLAN UE CellGate client 204.
  • the SIM card, used by the WLAN UE CellGate client 204, and the HLR 209 contain the root key.
  • the root key and the device identifier in addition to a Pseudo Random Function, are used to generate a Master key.
  • the Master key is then used to generate several other keys that are used to secure communication between the WLAN UE and other entities within the local network (e.g. WLAN AS or CellGate server).
  • the Appkey is the application-specific key.
  • the Masterkey is the Master key generated by the Home AAA server for the purpose of generating application-specific keys.
  • the Appname is a text string that includes the name of the application. For example the Appname for the Session Initiation Protocol could be "SIP".
  • a device When a device attempts to communicate with an application, it can generate the Appkey using the above formula (as an example) and attempt to authenticate the message using such key.
  • the application server can then pull the same information from the local Visited (or Home) AAA server to authenticate the message.
  • the Home AAA server is responsible for passing the authentication results to the local Visited AAA server. In addition, it passes the subscriber's (WLAN UE's) profile.
  • the profile includes the type of subscription, in addition to several other attributes that are used to indicate the level of service required for each subscriber and the services that a subscriber is authorised to use. Parameters which may be included in the profile may include:
  • the WLAN UE user's profile is used to control the user access by the visited WLAN Access Network and to guarantee that the user will only have access to billable services (to the Home network).
  • the WLAN UE 100 is successfully authenticated and authorised for network access, according to the procedures described previously, then the WLAN UE 100 is allowed to send and receive data traffic through the visited WLAN Access network 106.
  • the CellGate Server 110 receives the authentication results from the Visited AAA server 103. If the authentication was successful the CellGate server 200 communicates with the WLAN AS 105 to instruct it open up the filters for the WLAN UE by providing the WLAN AS with information identifying the WLAN UE such as IP address and lower layer (MAC) address. This allows the WLAN UE 100 to utilize the visited WLAN Access Network 106. If the generic WLAN AP 209 in the WLAN Access Network supports access filtering control then the CellGate server 200 communicates this information also to the WLAN AP 209.
  • MAC lower layer
  • the WLAN AS 105 can then handle the WLAN UE's traffic in different ways.
  • the same traffic handling function could be performed by the WLAN AP 209.
  • this functionality will be described using the WLAN AS as reference, but it should be noted that this part of the invention can be applied equally to the WLAN AP.
  • Two different routing methods are used for WLAN AS handling of WLAN UE traffic in this embodiment of the invention:
  • the WLAN AS 105 receives user policy information from the CellGate Server 200 following a successful authentication.
  • This policy information contains routing policy that informs the WLAN AS 105 how it should route data to or from a specific WLAN UE.
  • This policy may specify that a certain portion of the traffic, such as but not limited to the portion of traffic directed to the Home Mobile Services 206, should be routed towards the Wireless Gateway 203 in the home network through path 208 in Figure 2 , while remaining traffic, if any, should be routed directly to Internet through path 207 in Figure 2 .
  • the routing policy may specify that all traffic for a specific WLAN UE is to be routed to the Wireless Gateway 203 in the home network (path 208 in Figure 2 ) or all traffic is to be routed directly to Internet (path 207 in Figure 2 ).
  • the Direct Internet traffic routing case involves either communication to the Internet or corporate networks.
  • the CellGate server 200 sends policies to the WLAN AS 105 that require a secure tunnel to be used for the WLAN UE's traffic between WLAN AS 105 and the corporate network in 108.
  • This may be any type of secure IP tunnel including IPsec (IP security) and L2TP (Layer 2 Tunnelling Protocol) as described earlier.
  • the Home AAA server 110 communicates the traffic description and tunnel information to the Cellgate server 200, via the local visited AAA server 103, as part of the WLAN UE policy information described in section 0.
  • the WLAN AS 105 configures one IP tunnel per WLAN Gateway 202 in each collaborating cellular operator's home network.
  • the WLAN Gateway 202 that acts as the tunnel endpoint in the home network performs filtering and packet counting functions according to the security and charging policies of the home operator.
  • the WLAN UE CellGate client 204 is able to obtain usage and current account status information either from CellGate server 200, that would in turn obtain this information from the WLAN Gateway 202, or from the WLAN Gateway 202 directly.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Communication Control (AREA)

Claims (44)

  1. Verfahren zum Aufbau einer Verbindung zwischen einer mobilen Vorrichtung (100) und einem Netzwerk (108, 206) durch ein Zugangsnetzwerk (106), wobei die mobile Vorrichtung (100) über einen Heim-Handybetreiber subskribiert wird, wobei das Zugangsnetzwerk einen Zugangspunkt (209) zum Verbinden der mobilen Vorrichtung mit dem Zugangsnetzwerk, einen Zugangsserver (105) zum Vorsehen des Zugangs zum Netzwerk, und ein Gateway (200) zum Authentisieren der mobilen Vorrichtung und zum Instruieren des Zugangsservers umfasst, um den Datenverkehr zwischen der mobilen Vorrichtung (100) und dem Netzwerk zu erlauben, wobei das Verfahren Folgendes aufweist:
    - Übertragen einer Zugangsanfrage von der mobilen Vorrichtung (100) zum Gateway (200), wobei die Zugangsanfrage Daten zur Identifizierung der mobilen Vorrichtung umfasst;
    - Übertragen einer Authentisierungsaufforderung vom Gateway (200) zur mobilen Vorrichtung (100);
    - Übertragen einer Antwort auf die Authentisierungsaufforderung von der mobilen Vorrichtung (100) zum Gateway (200);
    - Bestimmen, ob die mobile Vorrichtung (100) autorisiert ist und, wenn die mobile Vorrichtung autorisiert ist:
    - Übertragen einer Meldung der erfolgreichen Authentisierung vom Gateway (200) zur mobilen Vorrichtung (100); und
    - Übertragen eines mobilen Vorrichtungsprofils inklusive der Art der Subskription und der Sicherheitsinformation mit einem Key vom Gateway (200) zum Zugangsserver (105).
  2. Verfahren gemäß Anspruch 1, das bei der mobilen Vorrichtung (100) ferner Folgendes aufweist:
    - Verschlüsseln der Daten unter Verwendung des Keys; und
    - Übertragung der verschlüsselten Daten zum Zugangsserver (105).
  3. Verfahren gemäß Anspruch 1 oder 2, das beim Zugangsserver (105) ferner Folgendes aufweist:
    - Empfangen der Daten vom Netzwerk (108);
    - Identifizieren, dass die Daten für die mobile Vorrichtung (100) unter Verwendung des mobilen Vorrichtungsprofils vorgesehen sind; und
    - Weiterleiten der Daten an die mobile Vorrichtung.
  4. Verfahren gemäß einem vorhergehenden Anspruch, das ferner Folgendes aufweist:
    - Übertragen einer Anfrage zur Authentisierung der mobilen Vorrichtung (100) vom Gateway (200) zu einem lokalen Authentisierungsserver (103) im Zugangsnetzwerk (106), wobei die Anfrage Informationen zur Identifizierung der mobilen Vorrichtung und eines Heimnetzwerkes umfasst;
    - Übertragen der Anfrage zur Authentisierung der mobilen Vorrichtung vom lokalen Authentisierungsserver zum Heim-Authentisierungsserver (110);
    - Übertragen einer Anfrage zur Sicherheitsinformation zur Authentisierung der mobilen Vorrichtung vom Heim-Authentisierungsserver über einen Heim-Aufenthaltsregister-Proxy zum Heim-Aufenthaltsregister;
    - Empfangen der Sicherheitsinformation zur Authentisierung der mobilen Vorrichtung beim Heim-Authentisierungsserver;
    - Herleiten der Authentisierungsaufforderung von der Sicherheitsinformation beim Heim-Authentisierungsserver;
    - Übertragen der Authentisierungsaufforderung vom Heim-Authentisierungsserver zum lokalen Authentisierungsserver; und
    - Übertragen der Authentisierungsaufforderung vom lokalen Authentisierungsserver zum Gateway.
  5. Verfahren gemäß Anspruch 4, wobei die Anfrage ferner Informationen zum Identifizieren des Gateways (200) umfasst.
  6. Verfahren gemäß einem vorhergehenden Anspruch, das ferner Folgendes aufweist:
    - Übertragen der Antwort auf die Authentisierungsaufforderung vom Gateway (200) zu einem lokalen Authentisierungsserver (103) im Zugangsnetzwerk (106);
    - Übertragen der Antwort auf die Authentisierungsaufforderung vom lokalen Authentisierungsserver zum Heim-Authentisierungsserver (110);
    - Vergleichen, beim Heim-Authentisierungsserver, der Antwort mit der Sicherheitsinformation zum Authentisieren der mobilen Vorrichtung;
    - Bestimmen, beim Heim-Authentisierungsserver, ob die Antwort mit der Sicherheitsinformation übereinstimmt; und
    - wenn die Antwort mit der Sicherheitsinformation übereinstimmt, Übertragen einer erfolgreichen Nachricht, die die erfolgreiche Authentisierung, die Sicherheitsinformation und das mobile Vorrichtungsprofil meldet, oder, wenn die Antwort nicht mit der Sicherheitsinformation übereinstimmt, Übertragen einer Fehlermeldung, die die nicht erfolgreiche Authentisierung vom Heim-Authentisierungsserver zum lokalen Authentisierungsserver meldet; und
    - Übertragen der erfolgreichen Meldung, Sicherheitsinformation und mobilen Vorrichtungsprofil, oder der Fehlermeldung vom lokalen Authentisierungsserver zum Gateway.
  7. Verfahren gemäß einem vorhergehenden Anspruch, das ferner Folgendes aufweist:
    - Ausführen einer Internet Protocol Security (IPsec) Internet Key Exchange (I-KE) Transaktion zwischen der mobilen Vorrichtung (100) und dem Zugangsserver (105) zum Aufbau einer sicheren Verbindung.
  8. Verfahren gemäß einem vorhergehenden Anspruch, das ferner Folgendes aufweist:
    - Erhalt der Antwort auf die Authentisierungsaufforderung bei der mobilen Vorrichtung (100), die eine Subscriber Identity Module (SIM) Karte oder 3G Universal Subscriber Identity Module (USIM) Karte verwendet.
  9. Verfahren gemäß einem vorhergehenden Anspruch, das ferner Folgendes aufweist:
    - Verwenden des Extensible Authentication Protocol für GSM Subscriber Identification Module (EAP-SIM) und/oder des Extensible Authentication Protokol für 3. Generation-Authentisierung und Key Agreement (EAP-AKA), um die Authentisierungsinformation zwischen der mobilen Vorrichtung (100) und einem Heim-Authentisierungsserver (110) zu transportieren.
  10. Verfahren gemäß einem vorhergehenden Anspruch, das ferner Folgendes aufweist:
    - Erzeugen, beim Heim-Authentisierungsserver und bei der mobilen Vorrichtung, von mindestens einem Master Key von einem Root Key zum Aufweisen in der Sicherheitsinformation, um die Verbindung zwischen der mobilen Vorrichtung und dem Zugangsserver sicherzustellen, und für den oder jeden Master Key eine optionale Lebensdauer für den Master Key und einen optionalen Algorithmus sicherzustellen.
  11. Verfahren gemäß Anspruch 10, das ferner Folgendes aufweist:
    - Erzeugen eines Keys beim Heim-Authentisierungsserver, um die Verbindung zwischen dem Zugangsserver (105) und einem Zugangsnetzwerk-Gateway (202) sicherzustellen, um den Zugangsserver mit dem Netzwerk zu verbinden.
  12. Verfahren gemäß Anspruch 11, das ferner Folgendes aufweist:
    - Übertragen des Keys, um die Verbindung zwischen dem Zugangsserver (105) und dem Zugangsnetzwerk-Gateway (202) zum Zugangsnetzwerk-Gateway sicherzustellen.
  13. Verfahren gemäß einem der vorhergehenden Ansprüche 10 bis 12, das Folgendes aufweist:
    - Erzeugen eines Keys, um die Verbindung zwischen dem Zugangsserver (105) und einem Anwendungsserver sicherzustellen.
  14. Verfahren gemäß einem der Ansprüche 10 bis 13, das ferner Folgendes aufweist:
    - Erzeugen eines anwendungsspezifischen Keys.
  15. Verfahren gemäß Anspruch 14, das ferner Folgendes aufweist:
    - Übertragen des anwendungsspezifischen Keys vom Heim-Authentisierungsserver zum Anwendungsserver.
  16. Verfahren gemäß Anspruch 14 oder 15, wobei der anwendungsspezifische Key verwendet wird, um eine sichere Verbindung zwischen der mobilen Vorrichtung und dem Anwendungsserver aufzubauen.
  17. Verfahren gemäß Anspruch 15 oder 16, wobei der Anwendungsserver einen Session Initiation Protocol (SIP)-Server aufweist.
  18. Verfahren gemäß Anspruch 15 oder 16, das Folgendes aufweist:
    - Erzeugen des anwendungsspezifischen Keys beim Heim-Authentisierungsserver und Übertragen des anwendungsspezifischen Keys zum Anwendungsserver, optional über einen lokalen Authentisierungsserver (103).
  19. Verfahren gemäß einem vorhergehenden Anspruch, das Folgendes aufweist:
    - Aufbauen der sicheren Verbindung zwischen der mobilen Vorrichtung (100) und dem Zugangsserver (105), drahtlosen Gateway (203), und/oder Netzwerk (108) unter Verwendung der Sicherheitsinformation.
  20. Verfahren gemäß Anspruch 19, das Folgendes aufweist:
    - Aufbauen der sicheren Verbindung unter Verwendung des Internet Protocol Security (IPsec) Internet Key Exchange (IKE)-Mechanismus.
  21. Verfahren gemäß einem vorhergehenden Anspruch, das Folgendes aufweist:
    - Konfigurieren eines sicheren IP-Tunnels durch den Zugangsserver (105) unter Verwendung des mobilen Anschlussprofils zwischen dem Zugangsserver (105) und einem Zugangsnetzwerk-Gateway (202) zum Verbinden des Zugangsservers mit dem Netzwerk.
  22. Verfahren gemäß Anspruch 21, das Folgendes aufweist:
    - Implementieren des sicheren IP-Tunnels unter Verwendung der Internet Protocol Security (IPsec) und/oder Layer 2 Tunneling Protocol (L2TP).
  23. Verfahren gemäß einem vorhergehenden Anspruch, das ferner Folgendes aufweist:
    - Erzeugen eines anwendungsspezifischen Sicherheitskeys zum Aufbauen der sicheren Verbindung durch Ausführen einer Hash Function auf dem Master Key und einer Anwendungs-Namensfolge.
  24. Verfahren gemäß einem vorhergehenden Anspruch, das Folgendes umfasst:
    - wenn die mobile Vorrichtung (100) autorisiert ist:
    - Übertragen einer Information vom Gateway (200) zum Zugangspunkt (209) oder Zugangsserver (105), um die mobile Vorrichtung (100) zu identifizieren, und einer Instruktion, um den Service für die mobile Vorrichtung vorzusehen.
  25. Verfahren gemäß Anspruch 24, das Folgendes aufweist:
    - Übertragen der Sicherheitsinformation vom Gateway (200) zum Zugangspunkt (209) oder Zugangsserver (105) zum Aufbauen der sicheren Verbindung zwischen der mobilen Vorrichtung (100) und dem Zugangspunkt oder Zugangsserver.
  26. Verfahren gemäß einem vorhergehenden Anspruch, wobei das mobile Vorrichtungsprofil Folgendes aufweist:
    - optional, Serviceniveauinformation zum Melden eines Serviceniveaus;
    - optional, Netzwerkadressinformation für die mobile Vorrichtung (100);
    - optional, lokale Serviceinformation zum Melden, ob es der mobilen Vorrichtung (100) erlaubt ist, um die lokalen Services innerhalb des Zugangsnetzwerks (106) zu nutzen;
    - optional, globale Serviceinformation zum Melden der Services, die die mobile Vorrichtung (100) benutzen darf;
    - optional, Zeitinformation zum Melden der Zeitdauer, während der die mobile Vorrichtung (100) Zugang zum Zugangsnetzwerk (106) haben darf;
    - optional, Datendurchsatz oder Mengeninformation zum Melden der Datenrate oder Datenmenge, welche der mobilen Vorrichtung (100) das Senden und Empfangen erlaubt, während sie sich im Zugangsnetzwerk (106) befindet;
    - optional, Neuautorisierung der Frequenzinformation zum Melden der Frequenz, mit der sich die mobile Vorrichtung mit einem Home-Authentisierungsserver (110) neu authentisieren soll;
    - optional, Tunnel-Endpunkt und Verkehrstypinformation für verschiedene Verkehrsarten zum Melden, ob Datenpakete, die zwischen der mobilen Vorrichtung und dem Netzwerk übertragen werden, getunnelt werden sollen, und wenn das so ist, Melden von zumindest der IP- und Anschlussadressen, Tunnelart und Sicherheitsinformation;
    - optional, lokale Sicherheitsinformation zum Melden, ob die mobile Vorrichtung eine sichere lokale Verbindung erfordert, die zwischen ihr selbst und dem Zugangsserver aufzubauen ist.
  27. Verfahren gemäß einem vorhergehenden Anspruch, das Folgendes aufweist:
    - Sperren der mobilen Vorrichtung (100) von der Nutzung der Services durch den Zugangsserver (105), so dass ihr kein Zugang erlaubt ist, und Versehen der mobilen Vorrichtung mit einer subskribierten Servicequalität in Abhängigkeit von der mobilen Vorrichtungsprofilinformation.
  28. Verfahren gemäß einem vorhergehenden Anspruch, das Folgendes aufweist:
    - Bestimmen durch den Zugangsserver (105), wie der Verkehr zu steuern ist, und ob ein sicherer IP-Tunnel zum Zugangsnetzwerk-Gateway (202) zum Verbinden des Zugangsservers mit dem Netzwerk in Abhängigkeit vom Tunnelendpunkt und der Verkehrsartinformation, die das mobile Vorrichtungsprofil enthält, aufgebaut werden muss.
  29. Verfahren gemäß Anspruch 28, das Folgendes aufweist:
    - Aufbauen eines sicheren IP-Tunnel zu jedem Zugangsnetzwerk-Gateway in den jeweiligen Heim-Netzwerken durch den Zugangsserver (105).
  30. Verfahren gemäß einem vorhergehenden Anspruch, das Folgendes aufweist:
    - Identifizieren der mobilen Vorrichtung (100) unter Verwendung einer International Mobile Subscriber Identity (IMSI);
    - Identifizieren der mobilen Vorrichtung unter Verwendung einer mobilen Subscriber Integrated Services Digital Network (MSISDN)-Nummer;
    - Identifizieren der mobilen Vorrichtung unter Verwendung eines Network Address Identifier (NAI); und/oder
    - Identifizieren der mobilen Vorrichtung unter Verwendung einer IPv4- und/oder IPv6-Adresse und/oder Medium Access Control (MAC)-Adresse.
  31. Verfahren gemäß einem vorhergehenden Anspruch, das Folgendes aufweist:
    - Identifizieren eines Heim-Netzwerkes der mobilen Vorrichtung (100) unter Verwendung einer International Mobile Subscriber Identity (IMSI), einer mobilen Subscriber Integrated Services Digital Network (MSISDN)-Nummer oder eines Netzwerkadressidentifizierers; und
    Identifizieren einer Netzwerkadresse des Heim-Authentisierungsservers unter Verwendung des Heim-Netzwerkes.
  32. Verfahren gemäß einem vorhergehenden Anspruch, das Folgendes aufweist:
    - Bestimmen durch den Zugangsserver (105), ob das mobile Vorrichtungsprofil spezifiziert, dass die Daten über einen Tunnel zu einem Unternehmensnetz oder einem Zugangsnetzwerk-Gateway (202) übertragen werden sollen,
    - wobei der Zugangsserver (105) eine IP-Adresse der mobilen Vorrichtung (100) von einem Adressenpool zuweist, der zum Unternehmensnetzwerk oder einem mobilen Heim-Netzwerk gehört.
  33. Verfahren gemäß einem vorhergehenden Anspruch, wobei die Sicherheitsinformation einen Sicherheitskey, eine Lebensdauer und einen mobilen Vorrichtungsidentifizierer umfasst.
  34. Zugangsnetzwerk (106), das Folgendes aufweist:
    - einen Zugangspunkt (209) zum Verbinden einer mobilen Vorrichtung (100);
    - einen Zugangsserver (105) zum Vorsehen des Zugangs zu einem weiteren Netzwerk (108);
    - einen Authentisierungs-Proxy (103) zum Erhalten der Authentisierungsinformation von einem Heim-Authentisierungsserver; und
    - ein Gateway (200), um die mobile Vorrichtung (100) zu authentisieren, um den Zugangsserver (105) zu instruieren, um den Datenverkehr zwischen der mobilen Vorrichtung und dem Netzwerk zu erlauben und ein mobiles Vorrichtungsprofil und die Sicherheitsinformation mit einem Key zum Zugangsserver (105) zu übertragen.
  35. Verfahren gemäß einem der Ansprüche 1 bis 33 oder Netzwerk gemäß Anspruch 34, wobei das Gateway (200) und der Zugangspunkt (209) einheitlich sind.
  36. Verfahren gemäß einem der Ansprüche 1 bis 33 oder Netzwerk gemäß Anspruch 34, wobei der Zugangsserver (105) und der Zugangspunkt (209) einheitlich sind.
  37. Verfahren gemäß einem der Ansprüche 1 bis 33 oder Netzwerk gemäß Anspruch 34, wobei ein lokaler Authentisierungsserver (103) und das drahtlose Gateway (203) einheitlich sind.
  38. Verfahren gemäß einem der Ansprüche 1 bis 33 oder Netzwerk gemäß Anspruch 34, wobei der Zugangsserver (105) und ein Zugangsnetzwerks-Gateway (203) zwischen dem Zugangsserver und dem Netzwerk (108, 296) einheitlich sind.
  39. Verfahren gemäß einem der Ansprüche 1 bis 33 oder Netzwerk gemäß Anspruch 34, wobei:
    - der Zugangsnetzwerk ein drahtloses Netzwerk ist;
    - die mobile Vorrichtung eine drahtlose Anwenderausrüstung ist;
    - der Zugangspunkt ein drahtloser Zugangspunkt ist; und
    - der Zugangsserver ein drahtloser Zugangsserver ist und
    - wobei der Zugangsnetzwerk, mobile Vorrichtung, Zugangspunkt und Zugangsserver das Internet Protocol unterstützen.
  40. Verfahren oder Netzwerk gemäß Anspruch 39, wobei:
    - der Zugangsnetzwerk (106) ein drahtloses Local Area Network (WLAN) ist;
    - die mobile Vorrichtung (100) eine WLAN-Anwenderausrüstung ist;
    - der Zugangspunkt (209) ein WLAN-Zugangspunkt ist; und
    - der Zugangsserver (105) ein WLAN-Zugangsserver ist.
  41. Verfahren oder Netzwerk gemäß Anspruch 39, wobei:
    - der Zugangsnetzwerk ein Orthogonal Frequency Division Multiplexing (UFDM)-Netzwerk ist;
    - die mobile Vorrichtung eine OFDM-Anwenderausrüstung ist;
    - der Zugangspunkt ein OFMD-Zugangspunkt ist; und
    - der Zugangsserver ein OFDM-Zugangsserver ist.
  42. Gateway (200) zur Verwendung in einem Zugangsnetzwerk (106) mit einem Zugangspunkt (209), Zugangsserver (105) und Authentisierungs-Proxy (103), wobei das Gateway die Authentisierungsinformation mit einem Heim-Authentisierungsserver (203) über den lokalen Authentisierungs-Proxy austauscht, um die mobile Vorrichtung (100) zu authentisieren und den Zugangsserver (105) zu instruieren, den Datenverkehr zu und von der mobilen Vorrichtung (100) zu erlauben und ein mobiles Vorrichtungsprofil und die Sicherheitsinformation mit einem Key zum Zugangsserver (105) zu übertragen.
  43. Gateway gemäß Anspruch 42, um eine Aufforderung gemäß des Extensible Authentication Protocols (EAP) zu übertragen.
  44. Gateway gemäß Anspruch 42 oder 43, um den Zugangsserver zu instruieren, wie der Datenverkehr zu und von der mobilen Vorrichtung zu steuern ist.
EP05109127A 2005-09-30 2005-09-30 Verfahren und Vorrichtung zum Aufbau einer Verbindung zwischen einer mobilen Vorrichtung und einem Netzwerk Active EP1770940B1 (de)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP05109127A EP1770940B1 (de) 2005-09-30 2005-09-30 Verfahren und Vorrichtung zum Aufbau einer Verbindung zwischen einer mobilen Vorrichtung und einem Netzwerk
AT05109127T ATE484143T1 (de) 2005-09-30 2005-09-30 Verfahren und vorrichtung zum aufbau einer verbindung zwischen einer mobilen vorrichtung und einem netzwerk
DE602005024000T DE602005024000D1 (de) 2005-09-30 2005-09-30 Verfahren und Vorrichtung zum Aufbau einer Verbindung zwischen einer mobilen Vorrichtung und einem Netzwerk

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
EP05109127A EP1770940B1 (de) 2005-09-30 2005-09-30 Verfahren und Vorrichtung zum Aufbau einer Verbindung zwischen einer mobilen Vorrichtung und einem Netzwerk

Publications (2)

Publication Number Publication Date
EP1770940A1 EP1770940A1 (de) 2007-04-04
EP1770940B1 true EP1770940B1 (de) 2010-10-06

Family

ID=36035829

Family Applications (1)

Application Number Title Priority Date Filing Date
EP05109127A Active EP1770940B1 (de) 2005-09-30 2005-09-30 Verfahren und Vorrichtung zum Aufbau einer Verbindung zwischen einer mobilen Vorrichtung und einem Netzwerk

Country Status (3)

Country Link
EP (1) EP1770940B1 (de)
AT (1) ATE484143T1 (de)
DE (1) DE602005024000D1 (de)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8554830B2 (en) 2006-09-06 2013-10-08 Devicescape Software, Inc. Systems and methods for wireless network selection
US8667596B2 (en) 2006-09-06 2014-03-04 Devicescape Software, Inc. Systems and methods for network curation
US8743778B2 (en) 2006-09-06 2014-06-03 Devicescape Software, Inc. Systems and methods for obtaining network credentials
US9326138B2 (en) 2006-09-06 2016-04-26 Devicescape Software, Inc. Systems and methods for determining location over a network

Families Citing this family (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8549588B2 (en) 2006-09-06 2013-10-01 Devicescape Software, Inc. Systems and methods for obtaining network access
DE102006060042A1 (de) * 2006-12-19 2008-06-26 Siemens Ag Verfahren und Server zum Bereitstellen eines zweckgebundenen Schlüssels
CN101132403B (zh) 2007-08-08 2012-09-05 华为技术有限公司 业务授权方法及服务器
JP5497646B2 (ja) * 2007-09-28 2014-05-21 デバイススケープ・ソフトウェア・インコーポレーテッド 無線ネットワーク選択のためのシステム及び方法
US9027119B2 (en) * 2007-11-19 2015-05-05 Avaya Inc. Authentication frequency and challenge type based on application usage
ITTO20070853A1 (it) 2007-11-26 2009-05-27 Csp Innovazione Nelle Ict Scar Metodo di autenticazione per utenti appartenenti ad organizzazioni diverse senza duplicazione delle credenziali
US8850230B2 (en) 2008-01-14 2014-09-30 Microsoft Corporation Cloud-based movable-component binding
CN101547383B (zh) 2008-03-26 2013-06-05 华为技术有限公司 一种接入认证方法及接入认证系统以及相关设备
GB2464553B (en) 2008-10-22 2012-11-21 Skype Controlling a connection between a user terminal and an access node connected to a communication network
GB2464552B (en) 2008-10-22 2012-11-21 Skype Authentication system and method for authenticating a user terminal with an access node providing restricted access to a communication network
CN101483525A (zh) * 2009-01-22 2009-07-15 中兴通讯股份有限公司 一种认证中心的实现方法
CN102056168A (zh) * 2009-10-28 2011-05-11 中兴通讯股份有限公司 接入方法及装置
US20130086218A1 (en) * 2011-09-30 2013-04-04 Corey F. Adams Proxy Server For Home Network Access
WO2013089604A1 (en) * 2011-12-16 2013-06-20 Telefonaktiebolaget L M Ericsson (Publ) A method and a network node for connecting a user device to a wireless local area network
US8938785B2 (en) * 2012-06-08 2015-01-20 Time Warner Cable Enterprises Llc Wireless session configuration persistence
EP2685752A1 (de) * 2012-07-10 2014-01-15 Gemalto SA Verfahren zum Zugreifen auf einem WLAN-Zugriffspunkt
WO2015131943A1 (en) * 2014-03-05 2015-09-11 Huawei Technologies Co., Ltd. Access node device for forwarding data packets
KR102157185B1 (ko) * 2014-07-04 2020-09-18 삼성전자주식회사 무선 통신 시스템에서 접속 계층을 통해 서비스 연결을 제공하는 장치 및 방법
WO2019174015A1 (zh) 2018-03-15 2019-09-19 Oppo广东移动通信有限公司 处理数据的方法、接入网设备和核心网设备
AU2017438908A1 (en) * 2017-11-07 2020-06-18 Guangdong Oppo Mobile Telecommunications Corp., Ltd. Data processing method and network device

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2003067439A1 (en) * 2002-02-04 2003-08-14 Flarion Technologies, Inc. A method for extending mobile ip and aaa to enable integrated support for local access and roaming access connectivity
AU2003212638A1 (en) * 2002-03-13 2003-09-22 Adjungo Networks Ltd. Accessing cellular networks from non-native local networks
CN100366007C (zh) * 2002-05-01 2008-01-30 爱立信电话股份有限公司 用于在无线局域网接入的基于sim的鉴权和加密的系统、设备和方法
US8341700B2 (en) * 2003-10-13 2012-12-25 Nokia Corporation Authentication in heterogeneous IP networks

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8554830B2 (en) 2006-09-06 2013-10-08 Devicescape Software, Inc. Systems and methods for wireless network selection
US8667596B2 (en) 2006-09-06 2014-03-04 Devicescape Software, Inc. Systems and methods for network curation
US8743778B2 (en) 2006-09-06 2014-06-03 Devicescape Software, Inc. Systems and methods for obtaining network credentials
US9326138B2 (en) 2006-09-06 2016-04-26 Devicescape Software, Inc. Systems and methods for determining location over a network

Also Published As

Publication number Publication date
EP1770940A1 (de) 2007-04-04
DE602005024000D1 (de) 2010-11-18
ATE484143T1 (de) 2010-10-15

Similar Documents

Publication Publication Date Title
EP1770940B1 (de) Verfahren und Vorrichtung zum Aufbau einer Verbindung zwischen einer mobilen Vorrichtung und einem Netzwerk
RU2304856C2 (ru) Способ и система, предназначенные для установления соединения через сеть доступа
EP3120515B1 (de) Verbesserter end-zu-end-datenschutz
AU2005236981B2 (en) Improved subscriber authentication for unlicensed mobile access signaling
EP1502388B1 (de) System, Apparat und Methode zur SIM basierten Authentifizierung und Verschlüsselung beim Zugriff auf ein drahtloses lokales Netz
US8045530B2 (en) Method and apparatus for authentication in a wireless telecommunications system
US20060019635A1 (en) Enhanced use of a network access identifier in wlan
EP2087689B1 (de) Authentifizierung in einem mobil-interworking-system
US20050114680A1 (en) Method and system for providing SIM-based roaming over existing WLAN public access infrastructure
KR102390380B1 (ko) 비인증 사용자에 대한 3gpp 진화된 패킷 코어로의 wlan 액세스를 통한 긴급 서비스의 지원
US20080026724A1 (en) Method for wireless local area network user set-up session connection and authentication, authorization and accounting server
US20130104207A1 (en) Method of Connecting a Mobile Station to a Communcations Network
WO2006024969A1 (en) Wireless local area network authentication method
US20150058938A1 (en) Integrated IP Tunnel and Authentication Protocol based on Expanded Proxy Mobile IP
US20040133806A1 (en) Integration of a Wireless Local Area Network and a Packet Data Network
WO2006013150A1 (en) Sim-based authentication
EP1624639B1 (de) SIM basierte Authentifizierung
RU2292648C2 (ru) Система, устройство и способ, предназначенные для аутентификации на основе sim и для шифрования при доступе к беспроводной локальной сети
GB2417856A (en) Wireless LAN Cellular Gateways
Tukkensæter User Friendly Access Solutions for Mobile WiMAX
Surtees et al. Combining W-ISP and cellular interworking models for WLAN
Wang Authentication for Inter-Domain Roaming in Wireless IP Networks
Jamalipour Data Integrity and Network Security in Wireless LAN/3G Integrated Networks
EP2578052A1 (de) Verfahren zur verbindung eines mobilstation an ein kommunikationsnetzwerk

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL BA HR MK YU

17P Request for examination filed

Effective date: 20070920

17Q First examination report despatched

Effective date: 20071029

AKX Designation fees paid

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REF Corresponds to:

Ref document number: 602005024000

Country of ref document: DE

Date of ref document: 20101118

Kind code of ref document: P

RAP2 Party data changed (patent owner data changed or rights of a patent transferred)

Owner name: ATHONET S.R.L.

REG Reference to a national code

Ref country code: GB

Ref legal event code: 732E

Free format text: REGISTERED BETWEEN 20110113 AND 20110119

Ref country code: NL

Ref legal event code: VDEP

Effective date: 20101006

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

REG Reference to a national code

Ref country code: CH

Ref legal event code: PUE

Owner name: ATHONET S.R.L.

Free format text: ALCYONE HOLDING S.A.#17, BOULEVARD ROYAL#2449 LUXEMBOURG (LU) -TRANSFER TO- ATHONET S.R.L.#AREA SCIENCE PARK PADRICCIANO 99#34139 TRIESTE (IT)

Ref country code: CH

Ref legal event code: NV

Representative=s name: ZIMMERLI, WAGNER & PARTNER AG

LTIE Lt: invalidation of european patent or patent extension

Effective date: 20101006

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110106

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110206

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110207

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110107

Ref country code: BE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110117

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

26N No opposition filed

Effective date: 20110707

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602005024000

Country of ref document: DE

Effective date: 20110707

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20110930

REG Reference to a national code

Ref country code: IE

Ref legal event code: MM4A

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20110930

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20110930

Ref country code: CY

Free format text: LAPSE BECAUSE OF EXPIRATION OF PROTECTION

Effective date: 20101006

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101006

REG Reference to a national code

Ref country code: CH

Ref legal event code: NV

Representative=s name: WAGNER PATENT AG, CH

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 12

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 13

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 14

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Ref document number: 602005024000

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: H04L0029060000

Ipc: H04L0065000000

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: IT

Payment date: 20230810

Year of fee payment: 19

Ref country code: GB

Payment date: 20230920

Year of fee payment: 19

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20230928

Year of fee payment: 19

Ref country code: DE

Payment date: 20230920

Year of fee payment: 19

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: CH

Payment date: 20231002

Year of fee payment: 19

REG Reference to a national code

Ref country code: DE

Ref legal event code: R082

Ref document number: 602005024000

Country of ref document: DE

Representative=s name: HL KEMPNER PATENTANWAELTE, SOLICITORS (ENGLAND, DE

Ref country code: DE

Ref legal event code: R081

Ref document number: 602005024000

Country of ref document: DE

Owner name: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP, SPR, US

Free format text: FORMER OWNER: ATHONET S.R.L., TRIESTE, IT

REG Reference to a national code

Ref country code: GB

Ref legal event code: 732E

Free format text: REGISTERED BETWEEN 20240509 AND 20240515